feat: migrate PentestCode to OpenCode V2

[acak1221]

Issue for this PR

 Closes #13.

 ### Type of change

 - [x] Bug fix
 - [x] New feature
 - [x] Refactor / code improvement
 - [x] Documentation

 ### What does this PR do?

 Migrates PentestCode 0.2.6 to OpenCode 2.0.18, with product version `0.3.0-v2.1`.

 - Upgrades the runtime, CLI/TUI, web app, client/SDK, build, installer and CI.
 - Ports all 21 pentest tools, 16 agent roles, 12 commands, bundled skills and engagement context to native V2 plugins.
 - Implements task DAG execution through V2 child sessions, permissions, cancellation and durable completion notifications.
 - Preserves existing engagement/knowledge data and configuration; migrates V1 transcripts and credentials.
 - Restores PentestCode branding and engagement creation, selection and sidebar flows.
 - Fixes #13 by sending the current session’s `x-opencode-session` on Go/Zen primary and auxiliary requests, with regression coverage.

Architecture and validation details: specs/v2/pentestcode-migration.md.

 ### How did you verify your code works?

 Locally on Linux x64 with Bun 1.4.2:

 - Workspace typecheck: 22 tasks passed.
 - Core: 5,697 passed, 11 skipped, 0 failed.
 - TUI: 1,434 passed, 2 skipped.
 - Web: 930 unit, 157 browser-unit, 7 icon, 4 boundary and 3 production Chromium E2E tests passed.
 - Shared session UI: 193 passed.
 - Built the Linux executable with embedded web UI and skills.
 - Verified compiled service authentication, persistence/restart, plugin activation and service election.
 - Verified interactive TUI engagement creation/selection and clean exit.
 - Validated the Node 26.4.0 bundle.
 - Repeated client generation with identical output hashes.

 Native Windows/macOS execution and Node SEA remain unverified locally.

 ### Screenshots / recordings

 Compiled TUI terminal capture excerpt after engagement creation and selection:

 ```text
 Final compiled TUI smoke
 Final smoke alpha
 recon · auto
 0 hosts · 0 findings · 0 credentials
 ```

 ### Checklist

 - [x] I have tested my changes locally
 - [x] I have not included unrelated changes in this PR

[s0ld13rr]

Hey @acak1221, thanks for this massive effort — porting the entire project to V2 is serious work and we appreciate it!

However, this PR is too large to review safely (3000 files, +752k/-250k). A few concerns:

1. Review scope: At this size, it's essentially a full codebase replacement. We can't meaningfully review for regressions across all 21 pentest tools, 16 agent roles, and 12 commands.

2. Issue v0.2.6: Built-in OpenCode Go provider doesn't send x-opencode-session (routing rejected since 2026-09-05) #13 is now fixed: The x-opencode-session header fix (which this PR also addresses) has been merged separately in a smaller, targeted commit (6cfd111).

3. Security review: With a pentesting tool, we need to carefully review every change for security implications — impossible at this scale in a single PR.

Suggestion: Could you break this into smaller, reviewable PRs? For example:

• PR for V2 catalog/provider integration
• PR for V2 session runner parity
• PR for tool migration (grouped by category)
• PR for TUI/CLI updates
• PR for build/installer changes

We'll keep this PR open as a tracking reference. If you'd like to discuss the migration strategy, feel free to open an issue and we can plan the incremental approach together.